Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS error on Azure auto unseal #701

Closed
arkpoah opened this issue Nov 5, 2024 · 1 comment
Closed

TLS error on Azure auto unseal #701

arkpoah opened this issue Nov 5, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@arkpoah
Copy link

arkpoah commented Nov 5, 2024

Describe the bug
Last week I reinstall our k8s Vault to minikube with Consul backend to test backup and upgrade.
Once consul backup restored, Vault has been auto unseal with azurekeyvault method, everything went well.
This week, when I restarted minikube, Vault 1.17.6 didn't start with following error :

error parsing Seal configuration: error fetching Azure Key Vault wrapper key information: Get "https://*********-vault.vault.azure.net/keys/********-vault-key/?api-version=7.4": remote error: tls: handshake failure

I tried to reinstall from scratch on 1.12.11 version, I got same kind of error with more information :

2024-11-05T09:32:04.887Z [WARN]  storage.consul: appending trailing forward slash to path
Error parsing Seal configuration: error fetching Azure Key Vault wrapper key information: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://*********-vault.vault.azure.net/keys/********-vault-key/?api-version=7.1: StatusCode=0 -- Original Error: adal: Failed to execute the refresh request. Error = 'Post "https://login.microsoftonline.com/********-4aa8-b64e-93ff94b0f533/oauth2/token?api-version=1.0": x509: certificate is not valid for any names, but wanted to match login.microsoftonline.com'

On Azure side this change was made between these two weeks :
Azure support for TLS 1.0 and TLS 1.1 will end by October 31, 2024

Is it can be related with something changes on Azure Vault ?

To Reproduce
Steps to reproduce the behavior:

  1. Deploy Vault-k8s with auto unseal azurekeyvault method

Expected behavior
Should unseal Vault server

Environment

  • Kubernetes version: 1.30.1
  • vault-k8s version: 1.12.11 & 1.17.6

Thanks

@arkpoah arkpoah added the bug Something isn't working label Nov 5, 2024
@arkpoah
Copy link
Author

arkpoah commented Nov 7, 2024

It was just a minikube network issue since it has restarted..

@arkpoah arkpoah closed this as completed Nov 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant